Enforce User.update :own across all permission sets. Verify READ bypass + UPDATE HasPermission pattern.